Vulnerability · Published Oct 31, 2026 · Assigned by drupal
CVE-2026-110176File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers
High 8.7
In plain English
A high-severity incorrect authorization in File Force Download from Drupal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty header array from that hook is itself a grant of access to the file. In versions 7.1.0 through 7.1.2, the module only delegated to other modules' hook_file_download() implementations when the file was in the private scheme. For every other scheme it returned its headers without any check. An unauthenticated visitor who appended download=1 to the URL of a file in the temporary:// scheme, or in a stream wrapper supplied by another module, could retrieve the file, overriding the access checks that would otherwise have applied. Files in the public and private schemes are not affected.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Drupal | File Force Download | 7.1.0 – before 7.1.3 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- HeroDevs vulnerability directory: CVE-2026-110176 third-party-advisory
- Tag1 D7ES advisory: File Force Download - Critical - Access Bypass third-party-advisory